codegeist-devcontainer-kit/entrypoint.sh at main · codegeist-ai/codegeist-devcontainer-kit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
#!/usr/bin/env bash
# entrypoint.sh - start dockerd for the devcontainer, then run the requested command
#
# Why this exists:
# - The devcontainer needs Docker tooling available inside the workspace.
# - Visible Chrome expects a system DBus socket even when browser traffic and UI
#   rendering are otherwise handled directly inside the container.
# - The `chrome` command points at the mounted workspace launcher so changes to
#   `.devcontainer/scripts/chrome.sh` do not require an image rebuild.
# - The Dockerfile sets USER to the workspace user, so dockerd is started through
#   passwordless sudo configured during image build.
# - A workspace-root `secrets.hcl` is passed directly to Vault Agent before the
#   requested command starts. The workspace configuration owns render targets
#   and errors stop container startup.
#
# Inputs:
# - The requested container command from Docker, Compose, or Dev Containers CLI.
# - CONTAINER_GROUP controls the dockerd socket group.
#
# Related files:
# - Dockerfile.base
# - Taskfile.yaml

set -euo pipefail

dockerd_log_file="/tmp/dockerd.log"
dockerd_pid_file="/var/run/docker.pid"
dbus_socket_file="/run/dbus/system_bus_socket"

ensure_chrome_launcher() {
  local launcher=""

  [ -n "${DEVCONTAINER_WORKSPACE_FOLDER:-}" ] || return 0
  launcher="$DEVCONTAINER_WORKSPACE_FOLDER/.devcontainer/scripts/chrome.sh"
  [ -f "$launcher" ] || return 0

  chmod +x "$launcher"
  sudo -n ln -sf "$launcher" /usr/local/bin/chrome
}

prepend_workspace_scripts_path() {
  export PATH="$DEVCONTAINER_WORKSPACE_FOLDER/.devcontainer/scripts:$PATH"
}

ensure_system_dbus() {
  if [ -S "$dbus_socket_file" ]; then
    return 0
  fi

  if ! command -v dbus-daemon >/dev/null 2>&1; then
    return 0
  fi

  sudo -n install -d -m 0755 /run/dbus
  sudo -n dbus-daemon --system --fork --nopidfile || true
}

clear_stale_docker_pid() {
  local existing_pid=""
  local existing_command=""

  if [ ! -f "$dockerd_pid_file" ]; then
    return 0
  fi

  existing_pid="$(cat "$dockerd_pid_file" 2>/dev/null || true)"

  if [ -n "$existing_pid" ] && kill -0 "$existing_pid" 2>/dev/null; then
    existing_command="$(ps -p "$existing_pid" -o comm= 2>/dev/null || true)"

    if [ "$existing_command" = "dockerd" ]; then
      return 0
    fi
  fi

  sudo -n rm -f "$dockerd_pid_file"
}

ensure_docker_daemon() {
  local attempt=""

  if docker ps >/dev/null 2>&1; then
    return 0
  fi

  clear_stale_docker_pid

  sudo -n rm -f "$dockerd_log_file"

  sudo -n env CONTAINER_GROUP="${CONTAINER_GROUP:-docker}" \
    DOCKERD_LOG_FILE="$dockerd_log_file" \
    bash -c '
      # Let Docker choose the storage driver so nested Docker can use overlay2
      # when available. Forcing vfs duplicates layers and exhausts disk quickly.
      nohup dockerd \
        --group "$CONTAINER_GROUP" \
        >"$DOCKERD_LOG_FILE" 2>&1 &
    '

  for attempt in $(seq 1 30); do
    if docker ps >/dev/null 2>&1; then
      return 0
    fi

    sleep 1
  done

  printf 'dockerd did not become ready\n' >&2

  if [ -f "$dockerd_log_file" ]; then
    tail -n 50 "$dockerd_log_file" >&2 || true
  fi

  return 1
}

ensure_system_dbus
prepend_workspace_scripts_path
ensure_chrome_launcher
ensure_docker_daemon

secrets_config="$DEVCONTAINER_WORKSPACE_FOLDER/secrets.hcl"
if [ -f "$secrets_config" ]; then
  vault agent -config="$secrets_config"
fi

if [ "$#" -eq 0 ]; then
  set -- bash
fi

exec "$@"